Skip to content
This repository was archived by the owner on Nov 16, 2020. It is now read-only.

Commit d6a5f71

Browse files
michaelklishinmichaelklishin
committed
Support more web_mqtt.ssl.* options, including cipher suites
References rabbitmq/rabbitmq-server#1712, rabbitmq/rabbitmq-server#1745.
1 parent 34d7ffa commit d6a5f71

File tree

2 files changed

+108
-6
lines changed

2 files changed

+108
-6
lines changed

‎priv/schema/rabbitmq_web_mqtt.schema

Lines changed: 44 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -55,6 +55,50 @@
5555
end
5656
}.
5757

58+
{mapping, "web_mqtt.ssl.honor_cipher_order", "rabbitmq_web_mqtt.ssl_config.honor_cipher_order",
59+
[{datatype, {enum, [true, false]}}]}.
60+
61+
{mapping, "web_mqtt.ssl.honor_ecc_order", "rabbitmq_web_mqtt.ssl_config.honor_ecc_order",
62+
[{datatype, {enum, [true, false]}}]}.
63+
64+
{mapping, "web_mqtt.ssl.reuse_sessions", "rabbitmq_web_mqtt.ssl_config.reuse_sessions",
65+
[{datatype, {enum, [true, false]}}]}.
66+
67+
{mapping, "web_mqtt.ssl.secure_renegotiate", "rabbitmq_web_mqtt.ssl_config.secure_renegotiate",
68+
[{datatype, {enum, [true, false]}}]}.
69+
70+
{mapping, "web_mqtt.ssl.client_renegotiation", "rabbitmq_web_mqtt.ssl_config.client_renegotiation",
71+
[{datatype, {enum, [true, false]}}]}.
72+
73+
{mapping, "web_mqtt.ssl.crl_check", "rabbitmq_web_mqtt.ssl_config.crl_check",
74+
[{datatype, [{enum, [true, false, peer, best_effort]}]}]}.
75+
76+
{mapping, "web_mqtt.ssl.depth", "rabbitmq_web_mqtt.ssl_config.depth",
77+
[{datatype, integer}, {validators, ["byte"]}]}.
78+
79+
{mapping, "web_mqtt.ssl.versions.$version", "rabbitmq_web_mqtt.ssl_config.versions",
80+
[{datatype, atom}]}.
81+
82+
{translation, "rabbitmq_web_mqtt.ssl_config.versions",
83+
fun(Conf) ->
84+
Settings = cuttlefish_variable:filter_by_prefix("web_mqtt.ssl.versions", Conf),
85+
[V || {_, V} <- Settings]
86+
end}.
87+
88+
{mapping, "web_mqtt.ssl.ciphers.$cipher", "rabbitmq_web_mqtt.ssl_config.ciphers",
89+
[{datatype, string}]}.
90+
91+
{translation, "rabbitmq_web_mqtt.ssl_config.ciphers",
92+
fun(Conf) ->
93+
Settings = cuttlefish_variable:filter_by_prefix("web_mqtt.ssl.ciphers", Conf),
94+
[V || {_, V} <- Settings]
95+
end}.
96+
97+
98+
%%
99+
%% Cowboy options
100+
%%
101+
58102
{mapping, "web_mqtt.cowboy_opts.max_empty_lines", "rabbitmq_web_mqtt.cowboy_opts.max_empty_lines",
59103
[{datatype, integer}]}.
60104
{mapping, "web_mqtt.cowboy_opts.max_header_name_length", "rabbitmq_web_mqtt.cowboy_opts.max_header_name_length",

‎test/config_schema_SUITE_data/rabbitmq_web_mqtt.snippets

Lines changed: 64 additions & 6 deletions
Original file line numberDiff line numberDiff line change
@@ -24,23 +24,81 @@
2424
[{rabbitmq_web_mqtt,
2525
[{ssl_config, [{ip,"127.0.0.4"},{port,15672}]}]}],
2626
[rabbitmq_web_mqtt]},
27+
2728
{ssl,
28-
"web_mqtt.ssl.ip = 127.0.0.2
29-
web_mqtt.ssl.port = 15671
29+
"web_mqtt.ssl.port = 15671
3030
web_mqtt.ssl.backlog = 1024
3131
web_mqtt.ssl.certfile = test/config_schema_SUITE_data/certs/cert.pem
3232
web_mqtt.ssl.keyfile = test/config_schema_SUITE_data/certs/key.pem
3333
web_mqtt.ssl.cacertfile = test/config_schema_SUITE_data/certs/cacert.pem
34-
web_mqtt.ssl.password = changeme",
34+
web_mqtt.ssl.password = changeme
35+
36+
web_mqtt.ssl.versions.tls1_2 = tlsv1.2
37+
web_mqtt.ssl.versions.tls1_1 = tlsv1.1",
3538
[{rabbitmq_web_mqtt,
3639
[{ssl_config,
37-
[{ip,"127.0.0.2"},
38-
{port,15671},
40+
[{port,15671},
3941
{backlog,1024},
4042
{certfile,"test/config_schema_SUITE_data/certs/cert.pem"},
4143
{keyfile,"test/config_schema_SUITE_data/certs/key.pem"},
4244
{cacertfile,"test/config_schema_SUITE_data/certs/cacert.pem"},
43-
{password,"changeme"}]}]}],
45+
{password,"changeme"},
46+
47+
{versions,['tlsv1.2','tlsv1.1']}
48+
]}]}],
49+
[rabbitmq_web_mqtt]},
50+
51+
{ssl_ciphers,
52+
"web_mqtt.ssl.port = 15671
53+
web_mqtt.ssl.backlog = 1024
54+
web_mqtt.ssl.certfile = test/config_schema_SUITE_data/certs/cert.pem
55+
web_mqtt.ssl.keyfile = test/config_schema_SUITE_data/certs/key.pem
56+
web_mqtt.ssl.cacertfile = test/config_schema_SUITE_data/certs/cacert.pem
57+
web_mqtt.ssl.password = changeme
58+
59+
web_mqtt.ssl.honor_cipher_order = true
60+
web_mqtt.ssl.honor_ecc_order = true
61+
web_mqtt.ssl.client_renegotiation = false
62+
web_mqtt.ssl.secure_renegotiate = true
63+
64+
web_mqtt.ssl.versions.1 = tlsv1.2
65+
web_mqtt.ssl.versions.2 = tlsv1.1
66+
web_mqtt.ssl.ciphers.1 = ECDHE-ECDSA-AES256-GCM-SHA384
67+
web_mqtt.ssl.ciphers.2 = ECDHE-RSA-AES256-GCM-SHA384
68+
web_mqtt.ssl.ciphers.3 = ECDHE-ECDSA-AES256-SHA384
69+
web_mqtt.ssl.ciphers.4 = ECDHE-RSA-AES256-SHA384
70+
web_mqtt.ssl.ciphers.5 = ECDH-ECDSA-AES256-GCM-SHA384
71+
web_mqtt.ssl.ciphers.6 = ECDH-RSA-AES256-GCM-SHA384
72+
web_mqtt.ssl.ciphers.7 = ECDH-ECDSA-AES256-SHA384
73+
web_mqtt.ssl.ciphers.8 = ECDH-RSA-AES256-SHA384
74+
web_mqtt.ssl.ciphers.9 = DHE-RSA-AES256-GCM-SHA384",
75+
[{rabbitmq_web_mqtt,
76+
[{ssl_config,
77+
[{port,15671},
78+
{backlog,1024},
79+
{certfile,"test/config_schema_SUITE_data/certs/cert.pem"},
80+
{keyfile,"test/config_schema_SUITE_data/certs/key.pem"},
81+
{cacertfile,"test/config_schema_SUITE_data/certs/cacert.pem"},
82+
{password,"changeme"},
83+
84+
{honor_cipher_order, true},
85+
{honor_ecc_order, true},
86+
{client_renegotiation, false},
87+
{secure_renegotiate, true},
88+
89+
{versions,['tlsv1.2','tlsv1.1']},
90+
{ciphers, [
91+
"DHE-RSA-AES256-GCM-SHA384",
92+
"ECDH-ECDSA-AES256-GCM-SHA384",
93+
"ECDH-ECDSA-AES256-SHA384",
94+
"ECDH-RSA-AES256-GCM-SHA384",
95+
"ECDH-RSA-AES256-SHA384",
96+
"ECDHE-ECDSA-AES256-GCM-SHA384",
97+
"ECDHE-ECDSA-AES256-SHA384",
98+
"ECDHE-RSA-AES256-GCM-SHA384",
99+
"ECDHE-RSA-AES256-SHA384"
100+
]}
101+
]}]}],
44102
[rabbitmq_web_mqtt]},
45103

46104
{websocket_endpoint,

0 commit comments

Comments
 (0)